Enlightenment 0.28.0 Release
Their alternative to Qt/GTK (EFL) also got a new release: https://www.enlightenment.org/news/2026-10-31-efl-1.29.0
Forecasting space weather risks on power grids
At a glance
- End-to-end forecasting: A machine learning pipeline uses forecast-time solar-wind information to generate location-specific risk estimates for 66,935 substations in the continental United States.
- Physics and place: The system combines Auroral Electrojet (AE) and Disturbance Storm Time (Dst) forecasts with local latitude, geology, and ground conductivity.
- Advance warning: The pipeline detected nearly 80% of major space-weather events during the evaluation period and can warn grid operators 30 to 60 minutes before a specific risk appears.
Forecasting a threat to critical infrastructure
During the May 2024 geomagnetic storm, utilities across North America prepared for possible impacts as auroras extended far beyond their usual range. The storm would degrade GPS accuracy and satellite operations, impacting farm operations in North America and Europe. Modern society depends on reliable electric power, yet extreme space-weather events can induce currents in transmission networks that damage equipment and increase operational risk. The challenge is not only knowing that a storm is approaching, but estimating when and where its effects could be most severe with enough warning for grid operators to respond.
During my summer internship at Microsoft Research, I developed a machine learning system that forecasts space-weather risk across 66,935 substations in the continental United States. The system measures how the sun’s activity can affect the earth’s magnetic field and, ultimately, the power grid. It combines solar-wind observations, forecasts of the Auroral Electrojet (AE) and Disturbance Storm Time (Dst) indices, physics-informed constraints, local geological conductivity, and grid-infrastructure data to produce location-specific risk estimates 30-60 minutes ahead of potential impact.
Building an end-to-end prediction pipeline
Space-weather prediction is difficult because it spans several coupled systems. The solar wind changes rapidly, its interaction with Earth’s magnetosphere is irregular, and the resulting ground effects depend on local conditions. Regions with resistive bedrock can experience stronger geomagnetically induced currents (GICs) than regions with more conductive geology. Transmission-line orientation, latitude, and other power-system characteristics further influence the exposure of individual assets.
The pipeline addresses this complexity in three stages, shown in Figure 1. First, solar-wind measurements from the L1 Lagrange point are used to generate forecasts of the AE and Dst indices, while geological conductivity and location features are assembled for each substation. Second, a gradient-boosting model combines these forecasted and location-specific inputs to estimate dB/dt, the rate of magnetic-field change associated with GIC risk. Finally, the resulting predictions are converted into location-specific risk estimates and aggregated into a continental risk assessment. A system of 50 AI agents helped explore features, validation strategies, and model configurations across the pipeline. Only public data sources were used, included NASA OMNI and NASA-aggregated Kyoto World Data Center data, INTERMAGNET and U.S. Geological Survey magnetometer observations, and GridSFM-derived grid data.
Evaluating geomagnetic forecasts and infrastructure risk
The AE predictor was designed to forecast rare, high-intensity geomagnetic activity that drives infrastructure risk. In the 2020-2026 evaluation period, the model produced forecasts spanning nearly the full observed range of AE activity and outperformed several empirical solar-wind-based approaches. The Dst predictor provided an additional signal describing large-scale geomagnetic storm strength. During the most geomagnetically active periods of the 2020-2026 evaluation period, the machine-learning model outperformed the Burton equation on 62.2% of individual hours. The model also produced a substantially wider prediction range than Burton-style approaches and improved severe-event detection in the end-to-end forecasting system by 1.2 percentage points when combined with AE forecasts.
| Predictor | Result | Baseline comparison | Impact |
|---|---|---|---|
| AE | 410.2 nT RMSE | Lower RMSE than empirical and solar-wind-only baselines | Captures extreme-event activity used by the GIC forecasting system |
| Dst | 7.2 nT RMSE | Outperformed Burton on 62.2% of peak-activity hours and provided wider prediction range | +1.2pp severe storm detection when integrated into final GIC system |
The GIC risk stage was evaluated differently. There is no equivalent widely deployed operational system that provides a direct industry benchmark for this calculation, so the machine learning model was compared with simple linear regression. As Figure 2 shows, the system achieved detection rates of 76.5% for major events (≥10 nT/min), 81.2% for severe events (≥20 nT/min), and 64.1% for extreme events (≥50 nT/min). False-alarm rates increased with storm severity, reflecting the trade-off between missed events and cautious alerts. Performance varied by latitude, with the highest detection rates at northern stations where geomagnetic activity is strongest.
OpenAI plans to train models on Daybreak Blue cybersecurity session data that was previously off-limits
Starting November 29, OpenAI will use data from Daybreak Blue sessions to train its models, even when users have turned off training. After backlash, a follow-up email promised a separate opt-out. The move revives concerns from the dispute with mathematicians who suspected OpenAI used their unpublished research for training without consent.
The article OpenAI plans to train models on Daybreak Blue cybersecurity session data that was previously off-limits appeared first on The Decoder.
Estimating Audio Transcription API Cost Per Minute in Go Before Production
Short answer: estimate transcription spend from the audio duration before accepting the job, then turn that estimate into a quota and an alert threshold. Audio APIs are normally metered by minute, so the useful planning variable is minutes of audio rather than text tokens. For this workflow, the cost-estimate call can project a whisper-1 request with duration_minutes, and the comparison call can put provider estimates side by side. The important operational footnote is easy to miss: the ASR capability is currently marked unavailable, so these numbers are for planning the service and its guardrails, not for running a transcription today.
That distinction changes the first page an on-call engineer sees. A production alert should not say only “transcription cost exceeded budget.” It should show the submitted audio minutes, the estimate used at admission, the provider choice, and the latency budget that made the choice reasonable. Otherwise the alert arrives after a batch has already become an accounting problem.
What should the cost alert show first?
Imagine the alert page at 02:10: the invoice-extraction queue is growing, estimated audio spend is above its hourly allowance, and p95 transcription latency has crossed the SLO. The person on call needs a decision, not another dashboard tile: reject new work, defer it, or accept slower processing for better extraction quality.
Work backward from that page. The signal that should have fired earlier was the estimate at admission time. For each invoice audio file, record duration, selected model, projected cost, and the quality-versus-latency policy that selected it. Aggregate those records by tenant and time window. A quota then becomes a control on planned work, while the later provider response remains a measure of what actually happened when ASR is available.
This is why I would estimate before uploading a large batch rather than discover the unit of billing in a month-end report. One key and one bill for every backend service can reduce credential and reconciliation sprawl, but it does not remove the need to own the admission rule. Centralized access is an operational convenience; it is not capacity planning.
How can I estimate the cost of an audio transcription API per minute?
Let M be the total audio minutes admitted in a window and C(m) the estimate returned for model m. A simple guardrail is:
planned_spend = sum(C(model, duration_minutes))
Stop admitting work when planned spend reaches the tenant quota, or when the remaining latency budget cannot absorb the queue. The formula is intentionally boring. Boring formulas are easier to audit when a supplier invoice is late, duplicated, or unusually long.
Do not substitute token accounting for duration accounting. Text generation and chat commonly expose input and output token units; transcription is typically priced per minute of audio. The right comparison is therefore minutes, expected quality, and end-to-end latency. A cheaper estimate that produces unusable invoice fields is not a cheaper pipeline after reprocessing and human review are included.
The cost estimate is a planning input, not a quality score. Keep a separate quality sample: field-level extraction accuracy, confidence review rate, and the fraction of invoices needing a second pass. That separation prevents a cost dashboard from quietly becoming the owner of an SLO it cannot observe.
Which provider fits an invoice-extraction pipeline?
There is no universal winner because the decision axis is quality versus latency, with cost acting as a constraint. OpenAI’s Whisper API is a familiar hosted option for teams already using its API surface. Google Cloud Speech-to-Text is a natural fit when the rest of the workflow already lives in Google Cloud and regional integration matters. Amazon Transcribe fits a similar AWS-centered operating model, with managed speech processing alongside other AWS controls. Deepgram is another real option for teams that prioritize a specialized speech API and need to evaluate streaming and batch behavior separately.
Those are materially different operating choices, not four labels for the same service. A hosted provider reduces model-serving work, while cloud-native placement can simplify identity, networking, and data-governance review. A speech-focused API may offer a better latency profile for the target language or audio mix, but that claim belongs in a controlled evaluation, not in a procurement spreadsheet. Self-hosting an open model with Ollama can improve control over deployment and data boundaries; it also moves capacity planning, model rollout, GPU utilization, and on-call responsibility onto the platform team.
Gemini can belong in a secondary comparison when audio understanding is part of a broader multimodal workflow, while OpenRouter and Together are better treated as routing or model-access alternatives than as dedicated transcription services. Anthropic and Claude belong in the same adjacent-platform category. I would not call any of those a direct replacement for a per-minute ASR benchmark; naming the boundary prevents a broad AI platform comparison from hiding the actual speech requirement.
For an independent comparison, I would score the candidates against the invoice corpus rather than rank them by a single per-minute number:
| Option | Useful fit | Cost and latency question | Boundary |
|---|---|---|---|
| OpenAI Whisper API | Existing OpenAI client and hosted transcription workflow | Does its service latency meet the batch SLO at the target duration mix? | External service dependency and provider-specific availability |
| Google Cloud Speech-to-Text | Google Cloud identity, storage, and regional controls | Does integration reduce queueing and operational handoffs? | Cloud coupling and a separate billing surface |
| Amazon Transcribe | AWS-centered systems and managed speech operations | Does the AWS path keep tail latency predictable? | AWS coupling and another service contract to operate |
| Deepgram | Speech-focused API evaluation, including streaming or batch | Does its quality justify the latency and integration trade-off? | Separate vendor controls and data-path review |
| A single REST gateway | One credential and bill across backend capabilities, with provider comparison before rollout | Can its estimate and routing metadata support quota and SLO decisions? | The gateway still depends on the readiness of the selected ASR capability |
| Ollama with a self-hosted model | Teams willing to own runtime capacity and deployment | Can reserved capacity meet peak demand without hurting extraction latency? | Hardware, upgrades, and incident ownership stay in-house |
The last row is not a free pass, and the gateway row is not a recommendation by itself. Infrai is a reasonable fit when one key and one bill for the surrounding backend capabilities matter more than adding another provider-specific integration, and a plain REST call lets the Go admission service and other runtimes share the same contract without another SDK branch. Its ASR readiness still has to be checked before rollout. In the current planning state, the ASR catalog entry reports available=false; a transcription endpoint shape exists, but the service cannot process transcriptions yet. That makes a pre-launch estimate useful for quotas and alert thresholds while making any claim about live transcrip
Workflow vs agent
Workflow vs Agent: Deterministic Orchestration & Dynamic Tool Selection
Quick Diagnosis
| Situation | Recommended approach | Why it fits |
|---|---|---|
| All steps known ahead of time (e.g., fetch data → prompt → parse → store) | Workflow | Immutable execution, easy testing, predictable token usage |
| Path depends on content or user intent (e.g., “answer any compliance question”) | Agent | Chooses tools at runtime, handles unknown sub‑tasks |
| Regulatory audit required (immutable logs, version‑controlled prompts) | Workflow | Deterministic runs produce repeatable audit trails |
| Live numeric value needed (credit score, market rate) | Tool call from workflow (authoritative API) | Guarantees freshness; does not rely on stale retrieval |
| Batch processing with tight cost budget | Workflow | One LLM call per step, predictable token usage |
| Real‑time, ad‑hoc question answering | Agent | Dynamic reasoning, on‑the‑fly tool selection |
| Mix of known skeleton + occasional live‑value request | Hybrid (workflow + runtime API/agent) | Keeps core deterministic, adds flexibility only where required |
Decision Flow
flowchart TD
A["Is the full execution path known ahead of time?"]
B["Can every required tool be enumerated?"]
C["Use a deterministic workflow"]
D["Is the request likely to need unknown sub‑tasks?"]
E["Add an agent layer for dynamic tool selection"]
F["Can live values be fetched via an API?"]
G["Expose API call from the workflow"]
H["Leave decision to the agent at runtime"]
A -->|Yes| B
B -->|Yes| C
B -->|No| D
D -->|Yes| E
D -->|No| F
F -->|Yes| G
F -->|No| H
Architectural Responsibilities
| Layer | Core duty | Typical implementation |
|---|---|---|
| Deterministic Orchestrator | Define the fixed sequence, validate inputs, enforce business rules, emit immutable logs | Azure Logic Apps, Temporal, Airflow, hand‑rolled Python DAG |
| Agent Core | Detect intent, decide which tool or retrieval source to invoke, manage ReAct‑style loops, handle fall‑backs | LLM prompting with function‑calling schema, structured reasoning templates |
| Tool / Retrieval Layer | Provide static knowledge (document store) or fresh data (authoritative API) | Azure Cognitive Search, public REST endpoints, token‑protected credit‑bureau API |
| Governance & Auditing | Record every step, version‑control prompts, certify compliance checks | Write‑once log storage, signed manifests, CI linting of workflow definitions |
| Cost & Latency Monitor | Track token usage, external‑API count, per‑step latency | OpenTelemetry exporters, custom metric dashboards |
Python Decision Helper (Teaching‑Only)
# decision_helper.py – pure stdlib, no external packages
import json
from pathlib import Path
from typing import Literal, TypedDict
class DecisionInput(TypedDict):
"""Minimal data required to pick workflow vs. agent."""
steps_known: bool # True if the entire sequence can be enumerated
tools_enumerated: bool # True if every tool can be listed up‑front
live_value_needed: bool # True if an authoritative API must be called
dynamic_subtasks: bool # True if request may spawn unknown sub‑tasks
def choose_strategy(data: DecisionInput) -> Literal["workflow", "agent", "hybrid"]:
"""
Return the recommended execution style.
* `workflow` – fully deterministic pipeline
* `agent` – pure agentic control
* `hybrid` – deterministic skeleton with optional runtime API or agent
"""
# Basic validation – fail fast if the contract is broken
assert isinstance(data["steps_known"], bool), "steps_known must be bool"
assert isinstance(data["tools_enumerated"], bool), "tools_enumerated must be bool"
assert isinstance(data["live_value_needed"], bool), "live_value_needed must be bool"
assert isinstance(data["dynamic_subtasks"], bool), "dynamic_subtasks must be bool"
if 
TrackyAi
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
What I Built
trackyAi is a lightweight, intelligent task and reminder tracking application designed to bring order to unstructured daily workflows right from the terminal.
Most task managers feel rigid, demanding strict field inputs, rigid tags, and manual date pickers. trackyAi interprets the theme Ghost in the Machine by acting as an ambient, context-aware digital whisper within your development environment. You feed it raw, conversational thoughts, rough terminal notes, or rapid reminders, and the underlying local intelligence silently parses intent, extracts target deadlines, infers priority, and schedules trackable actions—operating seamlessly in the background without pulling you out of your flow.
Demo
- GitHub Repository: https://github.com/RaqinAlAsraar/trackyAi
- Demo Video / Screenshot:
Code
RaqinAlAsraar
/
trackyAI
Hacktoberfest 26 project
🤖 Tracky AI
Your personal AI assistant for Telegram & WhatsApp.
Manages your daily task lists, timers, calendar events, and proactive reminders naturally through chat and voice.📌 What is Tracky AI?
Tracky AI understands plain, conversational language just like a human:
- "Create today's task list: prep demo slides, review pull requests, send email"
- "I have an exam on 30 October. Set a reminder for that day at 6:00 am"
- "Change it's timing to 7 am" (instant contextual rescheduling)
- "Show weekly tasklist" (grouped by day)
- "Delete previous tasklists as well which has no use now" (cleans up outdated lists)
Tracky runs 100% locally on lightweight smart NLP (<10ms response time, zero API quota usage), with optional support for local Ollama (
gemma2:2b) or Google Gemini cloud models.🚀 Quick Setup (3 Minutes)
1. Requirements
- Linux or macOS
- Python 3.10+
- Node.js 18+ (only needed for WhatsApp Web QR linking)
2.
…How I Built It
trackyAi is built entirely with Python and engineered for local-first execution and minimal overhead: - Open-Source AI Core: Utilizes local open-weight models (via Ollama / llama3.2) to perform fast, offline natural language understanding (NLU), entity extraction, and structured JSON intent parsing.
- Architecture: Structured around modular Python handlers for event scheduling, task persistence, and rule-based priority routing.
- CLI & Interface: Built using Rich and custom terminal styling to deliver clear visual dashboards, status indicators, and background system notification hooks.
- Zero Cloud Dependency: Runs completely locally on-device, ensuring zero API latency and absolute data isolation. Why Does Open Innovation Matter? Task lists, personal schedules, and daily dev notes hold sensitive context about your personal life, security workflows, and internal projects. Proprietary cloud-based LLM APIs require you to route private behavioral data to central servers just to parse a simple reminder. Open innovation and open-weight models change the paradigm completely:
- Absolute Privacy: Your personal routines and internal project goals stay strictly on your local machine.
- Offline Resilience: trackyAi works without an internet connection—whether you are working offline, on public transport, or in restricted lab environments.
- Full Customization: Open weights allow fine-tuning and strict system prompt constraints without worrying about sudden API deprecations or usage limits. The Spirit of It There is a distinct feeling of relief when you throw a chaotic mess of thoughts into a terminal prompt at 2 AM after a long debugging session, and an ambient assistant instantly sorts it into an organized, prioritized roadmap. trackyAi turns the cold, clinical command line into an intelligent companion that watches your back, keeps track of open loops, and ensures nothing slips through the cracks. Prize Categories
- Main Track: Open-Source AI Challenge — Week 4: Ghost in the Machine
- Local AI / Open-Weight Models: Best application built on locally executed, open-weight language models.
How I Built a Free Barcode Generator for the Browser
How I Built a Free Barcode Generator for the Browser
I built the free Barcode Generator on ToolsOfWeb to solve a small, annoying problem: every online barcode maker I tried either forced a sign-up, watermarked the download, or sent my product codes to a server. So I built one that runs entirely in your browser — type a code, pick a format, and download a clean PNG or SVG, with nothing leaving your device.
The tool covers the formats small shops and sellers actually need — Code 128, Code 39, EAN-13, EAN-8, UPC-A and ITF — plus batch mode for making many barcodes at once. This is how it was built, and why each decision was made the way it was.
Try the free Barcode Generator: Barcode Generator — make a free barcode for products, stock, parcels or price tags. Free · No sign-up · Works in your browser.
Why build a barcode generator that runs in the browser?
Because a barcode usually encodes something private: your product SKUs, order numbers or stock codes. A server-side generator receives all of that. A browser-side generator never sends it anywhere, works the moment the page loads, and answers instantly because there is no round trip to a server. Privacy is the feature here, not a bonus.
There was a second reason: cost. A tool with no server work behind it costs almost nothing to run, which is why it can stay free and unlimited. No account system, no database, no per-barcode fee — just a page that does its job and gets out of the way. Small sellers printing their first labels should not need a subscription for that.
How does a barcode actually store data?
A barcode is binary drawn as stripes. Each bar and gap has a width, and the pattern of widths encodes digits or letters. A scanner shines light across the stripes, reads the light and dark pattern, and decodes it back into characters. The bars hold the code itself; the price lives in the shop's database, not in the bars.
The idea is older than most people expect. On June 26, 1974, a pack of Wrigley's Juicy Fruit chewing gum became the first product scanned at a supermarket checkout, at a Marsh store in Troy, Ohio (source: Smithsonian Magazine's history of the barcode, corroborated by GS1 US). Fifty years later the same principle runs warehouses, parcels and shop tills — only the scanners got smaller. For a gentler introduction to the tool itself, see the free barcode generator guide.
How do you turn typed text into bars and spaces?
The tool uses JsBarcode, an open-source library that takes your text and a format and returns the exact bar pattern, including the check digit most formats require. Before drawing anything, the tool validates your input and explains problems in plain words: EAN-13 needs 12 or 13 digits, ITF needs an even digit count, and Pharmacode only accepts numbers in a fixed range. A broken input produces a clear message, never a broken code.
That validation step matters more than it sounds. A barcode that looks fine but encodes the wrong digits fails at the till, and the failure shows up in front of a customer. Check digits exist to catch exactly that: a final digit calculated from the rest, so a single mistyped digit makes the whole code invalid instead of silently wrong. The tool adds or checks that digit for you, so what you print is what the scanner will read.
Why does the generator offer so many barcode formats?
Because different jobs need different codes, and picking the wrong format produces a code a scanner rejects. Code 128 is the all-rounder for labels, stock and parcels because it handles letters and numbers. EAN-13 and UPC-A are the retail shelf codes printed on packaged goods. Code 39 suits simple internal warehouse labels, and ITF fits outer cartons. The tool lists each format with its rules, so you choose by job instead of by guesswork.
If you need more data than a one-dimensional barcode can hold — a link, a Wi-Fi password or a full contact card — that is the point where a two-dimensional code takes over, and the QR Code Generator covers that job instead. One-dimensional barcodes stay best at what they were designed for: short identifiers read fast, at a distance, by cheap scanners.
How does the barcode get drawn on screen?
The live preview is an SVG, which stays sharp at any size, and downloads come as SVG for print or PNG for documents — both generated on your device. PNG export draws the same barcode onto a canvas and saves it, so the downloaded file matches the preview exactly, with no watermark added. You can also set the bar width, height and label text before downloading, so the file fits your label sheet instead of the other way round.
Batch mode was added for the same reason: sellers rarely need one barcode. Paste a list of codes and download each barcode as its own PNG or SVG file, ready to drop into a label template. Everything still happens locally, so a list of a hundred SKUs is no slower and no less private than a single code.
What makes a barcode actually scan first time?
Contrast, size and a quiet zone. Print black bars on white, keep the code big enough for the distance the scanner will read it from, and leave a blank margin around all four sides — scanners need that empty border to find the edges of the code. A barcode squeezed against other text, or printed too small for its scanner, fails no matter how correct the digits are.
Test before you print a batch. Scan the code with a phone camera or a handheld scanner, at the distance people will actually use, and on the material it will live on — a code that scans perfectly on screen can fail on glossy labels or curved packaging. If the artwork needs resizing for a label sheet first, the Image Resizer handles that step without re-encoding anything.
What did I leave out on purpose?
Accounts, uploads and a product database. A barcode generator does not need any of them, so the tool has none: no sign-up, no server copy of your codes, and no record of what you generate. What you type stays in your browser tab and disappears when you close it. Leaving features out is a design decision, not a missing piece.
The same honesty applies to the limits. This tool draws the bars; it does not register a retail number with GS1, and it cannot look up what product a barcode belongs to — that lookup lives in the retailer's own system. A free tool earns trust by doing one job properly and saying plainly where that job ends.
FAQs
Is the barcode generator really free?
Yes. You can generate unlimited barcodes without signing up, and every download is clean — no watermark, no logo, no expiry. The tool is free because it runs in your browser, so there is no server cost behind each barcode you make.
Which barcode format should I choose?
For general labels, stock and parcels, use Code 128 — it handles letters and numbers and is the safest default. For products sold in shops, use EAN-13 or UPC-A, the retail shelf formats. For simple internal warehouse labels, Code 39 is enough. The generator shows the rules for each format before you print.
Do my codes get sent to a server?
No. Everything happens in your browser tab: the encoding, the preview and the download. Your product codes, SKUs and order numbers never leave your device, and closing the t
An Unwritten Diary: An AI-Powered Interactive Story Game inspired by the Oregon Trail
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
What I Built
I built An Unwritten Diary, an interactive historical survival narrative game inspired by my recent reading of the Diary of Anne Frank.
The player takes the role of a mother trying to protect their family while navigating life under Nazi occupation in the Netherlands. Throughout the game, players make difficult decisions that influence their family's relationships, resources, and circumstances.
I interpreted the theme as exploring how technology can help tell stories about the past. The incorporation of AI helps make the fictional characters and their experiences feel more personal and responsive.
Demo
Code
How I Built It
I am quite a greenhorn to all of this, being a college student who has only recently tried my hand at properly learning computer science. This is my first ever hackathon, and more than anything else, I wanted to learn from this. I built the frontend using TypeScript and Vite, with my past experience on this being only a tiny dabble into TypeScript. I used Express.js for the backend, handling communication with Google's Gemini API. It was honestly a shock to me how relatively easy everything was to pick up, thanks to it all being open-source with plenty of documentation. I had, before this month, barely even known what a backend or API was.
Some of the main technologies I used include:
- TypeScript
- Vite
- Express.js
- Google Gemini API (
gemini-3.5-flash-lite) - Google Gemma API (gemma-4-26b-a4b-it)
- Git and GitHub
- Vercel and Render for deployment
This was a particularly valuable project for me in learning the basics of how frontend and backend systems communicate, how to integrate an AI API, and how to deploy a full-stack application.
Why Does Open Innovation Matter?
Open innovation matters because projects like this benefit from being built on tools and technologies that developers can access, learn from, and contribute to. I myself looked at other people's dev posts to try to gain inspiration while making the project. I can't seem to find how to view the past week's entries, but I remember one submission about a program made to help a friend with diabetes prevent late-night spikes without invading his privacy. It amazed me how creative and amazing everyone's projects were, and I hoped to add something of my own, no matter how much it may pale in comparison.
I also found it really nice how easy an open-source project was to share. GitHub was, as always, great to share my code, but Render was also really easy to pick up and use. I even exclaimed to my little brother how quickly I got it working.
The Spirit of It
Personally, as already described, this project was a learning experience for me. But for the game, I had a vision in mind for what it was to represent and what emotion or feeling I hoped for it to instill. History is often taught through dates, statistics, and major events. Those are important, but they can sometimes make it difficult to appreciate the uncertainty and personal decisions ordinary families faced. I found that both playing The Oregon Trail and reading the Diary of Anne Frank made me empathize with the individual experience, beyond statistics or raw numbers. Thus, with the hackathon ongoing, I felt motivated to design a game that fused the two.
I wanted to imitate The Oregon Trail's text-based storytelling and pre-designed options, but add a twist where the player can add their own custom input to influence the story. There will be a baseline result that the AI adds onto based on the player's input, and if the player chooses without entering additional details, the game uses the baseline result. I also implemented response validation to help ensure that AI-generated content follows the game's expected structure and respects the game's mechanics.
By putting the player in the position of a fictional parent, I hoped to make those difficult circumstances more understandable on a personal level. Whether or not I did that well is up to you to decide.
Prize Categories
Best Use of Gemma: I integrated Google's Gemma open-weight model as an alternative to Gemini in the game's narrative generation system. Players can choose between the two models when adding custom details to their decisions, allowing Gemma to generate personalized narrative responses. At the same time, the game validates the resulting content and stat adjustments. This is slightly subjective, but I felt like Gemma gave better responses, though noticeably slower.
Safe archive extraction must validate the final path
Safe archive extraction must validate the final path
Archive extraction looks like a file operation until an archive contains a member named ../../etc/file, an absolute path, or a symbolic link that changes where the next member is written. The resulting problem is commonly called Zip Slip, but the same class of failure appears in tar files and custom archive formats.
Checking whether a filename contains .. is not a complete defense. A member can be a symlink, a hardlink, or a path that resolves differently because the destination directory contains an existing link. Two archive members can interact: the first creates a link and the second writes through it. A live directory where another process can create or replace paths adds another race.
Validate the object and the destination
Applications should use extraction filters or safe extraction APIs provided by the language or archive library. Python's tarfile documentation explicitly warns that extraction can overwrite arbitrary files through absolute paths, parent components, or symlinks, and provides filters that refuse links outside the destination and limit extracted size and file counts. Use the filter that matches the application's needs instead of writing a regular-expression check around names.
Create a new destination directory for the extraction. Do not extract into /tmp, a shared upload directory, or a directory controlled by another user. Check the resolved destination after every link operation, constrain the archive's expanded size, and reject unsupported member types. For a service that processes untrusted archives, run extraction in a sandbox with only the input and output directories mounted.
The final path must be derived from a trusted root and the archive member's resolved location. A string that starts with the expected prefix after simple textual normalization can still point through a symlink. Use a path API that resolves the final object, or keep the extraction root inaccessible to other processes while it is active.
Test the failure modes
Build a small archive containing ../escape, an absolute path, a symlink to the parent directory, and a hardlink to a file outside the root. Confirm that each member is rejected before it changes the filesystem. Repeat the test when the destination already contains a symlink. Add a size-limit test and a member-count test.
Review the extraction library version and its default filter. A default can change between language releases, and an application may override it. Record the chosen policy in code and in the deployment image. If the application extracts only one known format from a trusted publisher, state that assumption and verify the publisher's signing path; do not use it to excuse an unsafe library default.
A safe extractor proves two things: the archive cannot write outside the chosen root, and it cannot create a link that a later member can use to escape. Testing only the filename is not enough for either claim.
References
Amazon made the AUX input on older Alexa devices less useful
世界模型首次指导设计芯片！超大核NPU700TOPS，99%算力可用
L4需要更大的模型，芯片得换个造法了
（本文作者为 互联网江湖，钛媒体经授权发布）
文 | 互联网江湖，作者 | Evin，编辑 | 刘致呈
如果你长期跟踪智驾行业，会察觉到一个变化正在悄然发生：发布会上的主角，正在从“技术”换成“量产”。
2026年以来，L4落地声量明显抬升，城市NOA渗透率持续走高，车企量产军备竞赛全面打响。
从“技术竞争”换轨到“量产竞争”，已是行业明牌。
但换轨途中横着一个尴尬的现实：多数通用芯片正在拖量产的后腿。
车规环境下，通用芯片的“不可能三角”凸显：账面算力与有效算力相差悬殊，利用率往往只有30%—40%。
这笔被浪费的差价，堪称L4规模化路上一笔“隐性税”。
10月29日，转机出现了。
XHEART新芯航途CEO李宗霖正式发布大模型芯片X7 Ultra：700 TOPS大模型算力、超大核NPU、高精度专用算子加速、Armv9车规级CPU。
这颗芯片自创立之初就沿着一条另类的路线前行——“大模型定义芯片”：不追求通用性的面面俱到，而是由大模型反向定义硬件。
这有点像当年的DeepSeek。
DeepSeek的出现为AI行业指明了，大模型不必沿着旧算力逻辑硬堆也能跑出新的可能性，此后AI应用如雨后春笋般生长。
如今，X7 Ultra则为L4验证了，L4的落地也不必拘泥于通用芯片的算力瓶颈，L4量产落地，有了一条新路。
自此，L4量产的DeepSeek时刻来了。
大模型芯片发布，L4落地有了“新基建”
大模型定义芯片不是实验室里的炫技，而是量产需求倒逼出来的必然产物。
推动力首先来自市场端。
最近一段时间，车企新车的大模型和辅助驾驶能力正在全面标配。
工信部数据显示，2026年以来乘用车组合驾驶辅助渗透率已达70.5%，NOA渗透率超过30%，首批L3车型也开始在特定区域上路。
随着端到端的智驾普及，接下来，车企的每一款新车立项，都会用上更强的芯片。
与此同时，AI模型体量越来越大，对芯片性能的要求也越来越高。
Momenta CEO曹旭东判断，未来规模化L4需要10B—100B量级的大模型来应对复杂长尾场景。
新一代大模型规模化上车，带来的直接问题是：通用芯片接不住。
为什么接不住？
因为量产赛场上最难的，是三条互相拉扯的硬指标。
首先，要“跑得起来”，就得满足算力和功耗的硬性要求——10B—100B的模型要在几十瓦功耗、毫秒级延迟下运行，通用芯片为灵活性预留的架构冗余，在车端反而成了负担，大量算力耗在架构开销而非有效计算上。
其次，要实现“规模上车”，那么对应成本——成本必须降到付费方持续买单的水平，并为折旧运维留出利润空间。而在通用芯片的定价体系下，车企很难算平成本账。
最后一点，也是最重要的一点：安全。L4阶段责任主体转移到主机厂，安全成为“生死线”，芯片的计算行为必须可预测、可验证——同样的输入产生稳定输出，负载变化时延迟可控，结果可被完整追溯。而时快时慢、利用率飘移的通用平台，撑不起安全底线的工程化验证。
最终，结论只有一个：市场需要一颗从大模型需求出发设计的大模型芯片。
L4的落地发展，其实有点像前几年AI行业。
ChatGPT火了之后，模型对算力的需求越来越大，直到DeepSeek给AI行业开辟了一条新路。
从底层逻辑上来看，大模型定义芯片，恰如当年DeepSeek的发布。
DeepSeek证明了AI大模型不必硬堆参数、硬烧算力卡，通过架构创新提升AI infra层的效率，也能跑出规模应用。如今，在L4这个赛道，X7 Ultra发布之后，XHEART通过NPU架构创新，再次验证了这条路径。
从这个意义上讲，XHEART和Momenta要做的事情，相当于L4落地的“新基建”。
L4怎么量产落地？
关键核心在于解决几个问题：
第一，从NPU入手，解决效能问题。
传统智驾芯片的NPU由多个小核拼凑，核间数据交互在百GB/s量级，大量算力耗在“内部搬运”上。
大模型定义芯片则从根本上解决了这个问题。X7 Ultra把计算单元聚合成一个超大核，内部互联速率拉到TB/s级。
但仅此还不够，数据能在核内高效流动，计算本身也得高效。
这就是第二点：靠专用算子，解决延迟问题。
Transformer架构里的高频计算，过去在NPU里跑不动、只能绕道CPU，一来一回既费带宽又费时间。
为此，XHEART从2023年起便与Momenta算法团队联合研究模型架构及关键算子，为这些高频算子配备了专用硬件，原生支持FP16/FP32高精度向量计算——关键计算既快，又不丢精度。
高精度带来计算行为的确定与可预测，这正是安全验证的物理基础。
还有，靠整网级工具链重构，解决最终上车的问题.
传统推理是算子逐个执行、中间结果反复写回外部内存；XHEART的做法是把整张网络统一编排、融合，实现“整网内存零拷贝”，结果就是内存带宽消耗降下来了，同一块芯片能跑更大的模型，单位算力的成本自然也就降下来了。
最终实测数据给出了答案：NPU计算利用率98.7%，内存带宽消耗比行业旗舰低80%，能效翻倍。
X7 Ultra的700 TOPS大模型算力，也是在真实量产智驾模型上测得的，前提是量化后模型输出与FP32模型的相似度达到99.99%以上。模型结构不能随意改，精度和驾驶体验不能打折——性能优化从一开始，就要对准量产要求。
实际上，大模型定义芯片，不是在某一个指标上做加法，而是让此前互相拉扯的算力、成本、安全，在同一个架构里被同时满足——它给L4的到来铺平了一条路。
对行业而言，这背后还意味着一场更深层的变化：智驾的竞争逻辑，正从“堆算力”转向“系统竞争”。
过去L2普及阶段，行业信奉“算力越高，智驾越强”的公式，但现在，L4落地要求系统竞争，背后是算力、成本、功耗、安全四者之间的协同。
简而言之，这场比赛的规则变了，从“单项锦标赛”进入了“团体赛”。
这个逻辑在新能源汽车行业已有先例：比亚迪的闪充技术本质上就是“系统竞争”：单靠堆电池容量解决不了补能焦虑——只有当电池、平台、桩、储能在架构层面协同设计，快充才能真正落地。
同理，单靠堆算力也解决不了智驾的天花板。
把镜头再拉远一点，大模型芯片并非孤例，而是专用化AI芯片浪潮中最先被推到台前的场景之一。
芯片专用化、软硬一体早已是大势所趋。
谷歌TPU从诞生之初就只为加速神经网络计算服务，专用芯片正变成AI算力结构中的重要一极。
汽车行业亦然，主机厂不再满足于采购通用座舱或智驾芯片，而是直接参与定义甚至自研专用芯片，L4量产阶段尤甚。
X7 Ultra正是这个逻辑的产物：它对大模型的“适配”不是软件层面的修修补补，而是架构层面的血脉相通——不做算法去适配芯片，而是芯片天然契合大模型计算。
这等于从芯片定义逻辑上，诞生了一个新物种。而这个新物种，不是L4的配套，而是L4量产的前置条件。
从此，L4量产的大门才真正被打开。
L4只是起点，真正的未来在物理AI
在汽车产业链条上，判断一条技术路线的成色，最终要回到一个朴素的问题：它装进车里了吗？
在这一点上，Momenta与XHEART已经交出了答卷。
X7系列的客户车型包括上汽大众ID. ERA 9X/8X、荣威家越07、MG07等，从德系合资巨头到自主品牌头部，这表明双方的软硬协同已跨过“PPT协同”阶段，进入可验证的商业化落地。
同时，也足以见得大模型定义芯片，未来商业化落地的路径清晰。
从智驾技术演进来看，量产本身就是最好的验证场。
只有在真实车型、真实用户、真实路况中打磨成熟的软硬协同能力，才能更好迭代，产品技术，进而带动L4进一步实现规模化。
曹旭东给出的时间表是：L3和L4有望在2028年迎来重要引爆点，2030年走向规模化落地。
加速这一进程的，正是大模型芯片。
当模型需求直接定义芯片，算法、软件、芯片的迭代节拍第一次被拉到同一节奏上，行业进化速度自然会变快。
据了解，基于X7 Ultra的支撑，Momenta发布的R7 Ultra世界模型，参数规模将扩大5—10倍，安全性能同步提升5—10倍以上，推动世界模型从“理解世界”走向“推演世界”。
至此，L4 商业化落地的最后一块拼图，已经摆上了桌面。
但如果只盯着眼前的装车量，仍然低估了大模型定义芯片的价值。
大模型定义芯片的想象力，可能远不止于L4。
它更深的护城河，在于这套研发方式可以迭代延续：一颗为模型而生的芯片，其研发过程沉淀的是可继承的资产——量产模型参与硅前验证的经验、模型与芯片团队联合调试的协作机制、精度与效率之间取舍的方法论……
这些无形资产不会随一代产品退役，而会完整传递到下一代芯片上，支撑未来更大的模型在性能、能效、系统成本和交付效率上持续优化。
这个剧本似曾相识。
当年，英伟达靠CUDA生态绑定AI开发，也是靠芯片架构技术代际更迭能力，统治了AI算力市场。如今，专注芯片、聚焦AI计算、以软硬件协同构建壁垒，大模型芯片的进化逻辑，某种意义上与之高度相似。
这个方向下，XHEART的定位从一开始就不止于智驾，其官方表述是“一家专注于大模型计算的芯片设计公司……并应用于智能汽车，现正向机器人等领域拓展”。
曹旭东也明确指出，大模型定义芯片的思路可以进一步推动机器人以及更多物理AI应用取得突破。
物理AI的命题，是“大模型必须在物理世界的实时约束下运行”——要省电、要低延迟、要成本可控、要行为可验证。
这意味着今天在量产车上被验证过的这套解题方法，明天可以复用到人形机器人、移动机器人，以及一切需要“聪明的大脑+可控的躯体”的物理AI产品上。
也因此，未来芯片的持续研发与规模交付，夯实的不只是Momenta在汽车赛道的长期竞争力，更是两家公司为整个物理AI时代铺设的智能底座。
大模型芯片的前景如何，资本市场的动作往往最诚实。
XHEART的战略融资，参投阵容很有看点：雷诺集团首次投资，奇瑞汽车追加，长鑫科技入局。
产业端，开始真金白银地下注了。
三家资方的诉求各不相同：雷诺看中的是智驾供应链的确定性与下一代车型的计算底座；奇瑞追加投资，要的是量产芯片稳定供给的深度绑定；长鑫科技的入局，则指向存储与算力协同的产业纵深。
诉求不同，但指向同一个判断：一家能把算法能力硬件化的芯片公司，在智驾走向软硬一体的趋势里，有不可替代的位置。
对XHEART而言，这笔融资的意义不在于财务数字，而在于未来芯片持续研发和规模交付的确定性。
芯片是一门重资产生意：从架构立项到流片上车以年计，持续的研发投入、产能保障、车规认证，每一环都需要长期弹药。
50亿融资与已经铺开的客户阵列，就是这种确定性的最佳展现。
眼下，汽车行业的规模化L4是确定的，模型能力与量产能力同步增长的需求是确定的；剩下的变数在供给端。
接下来，谁先贯通了模型、芯片与整车应用，谁就可能真正打开通向未来的那扇门。
而眼下，打开这扇的钥匙已经握在了Momenta和XHEART的手中。
更多精彩内容，关注钛媒体微信号（ID：taimeiti），或者下载钛媒体App
Artificial Analysis v5 and the benchmarker's dilemma - Interconnects AI
Jules Verne's Lost Novel
Rebuild Dossier: Mechanically-Enforced Specs for Agentic App Rebuilds, and What Model-Tier Failures Reveal
Fine-tuning Multi-modal LLMs with ART: Art-based Reinforcement Training
Code2LoRA: Hypernetwork-Generated Adapters for Code Language Models under Software Evolution